Search for data in Kibana

At the top of the Kibana Log Visualizer, you can input queries to filter the information displayed. You can use operators in the queries as well.

The most important operators in the Kibana Log Visualizer are:

Boolean operators (must be uppercase): AND, OR, "-" (NOT)

Exact phrase matches using quotes: "An error occurred"

Wild cards: *Exception*

Field-specific queries: _type:bb-services

Kibana treats dashes as Boolean operators in a query, so we suggest that you use quotations to search for an error ID in order to avoid confusion. For example, if you are looking for error ID 051b5b1c-34ab-44f5-8532-5c3a6b0e08fb in bb-services.log, use the query path:"/usr/local/blackboard/logs/bb-services-log.txt" AND message:051b5b1c or path:"/usr/local/blackboard/logs/bb-services-log.txt" AND message:"051b5b1c-34ab-44f5-8532-5c3a6b0e08fb". In either case, you want to enclose the error ID in quotation marks to avoid Kibana using the dash as a Boolean operator.

Example queries

Action

Query

Search SafeAssign logs for error messages

path:*mdb AND _type:plugins AND message:error

Display the last date/time a rolling restart occurred

message: "Blackboard application server starting"

Locate Web Services logs

path:"/usr/local/blackboard/logs/ws/"

Search for course_main.pk1 and exclude bb-access-log

message:"_93945_1" AND -path:"bb-access-log"

Search for Respondus Lockdown Browser events for a course_main.pk1 and exclude the bb-access-log

message:("lockdown" AND "_100314_1") AND -path:"bb-access-log"

Select the checkboxes in the All Events table below the visualizer to filter the list of results. You can copy the stack trace, but if you use a browser other than Chrome, the text may be formatted incorrectly when you paste it.